ADRestore.NET rewrite

15 בדצמבר 2007

21 תגובות

Last month I had couple of clients that needed to restore accidentally deleted user and computer account. Though there is a command line version of tombstone reanimation tool called adrestore, the clients were not CLI savvies and having a GUI version of this functionality could really help them out. Some time ago I wrote a GUI version just for the case in VB.NET, but as it turned out it was quite buggy (well, it was one of my first .NET GUI apps), so I set down and rewrote the application from scratch in C#.

Now, if you are not familiar with the concept of tombstone reanimation, I would suggest that at this point you go and read Gil Kirkpatrick's article at Techent – it explains what tombstones are and how does the tombstone reanimation process works.

So, if you are aware of tombstone reanimation limitations (only a small set of attributes is restored), still willing to restore a deleted object and prefer a GUI version, you will probably find this little tool useful.

Main features:

  • Browsing the tombstones
  • Domain Controller targeting
  • Can be used with alternative credentials (convenient if you do not logon to your desktop as Domain Admin, which you should never do anyway)
  • User/Computer/OU/Container reanimation
  • Preview of tombstone attributes

Here are some sceenshots:

Enumerating tombstones

 image

Previewing the tombstone attributes

image

Restoring a deleted user account

image

Notice that if you delete an OU with accounts in it, you will have to restore first the OUs the accounts were in, otherwise the reanimation of the child object will fail. It is not enough to create an OU with the same name as this will be a totally new object in AD and child object's lastKnowParent attribute will still reference the deleted OU. Here is a walthrough:

Initial state:

image 

TestOU organizational unit is deleted:

image 

State of tombstones (notice that lastKnownParent attribute of user and computer accounts reference the deleted OU):

image

OU is restored (lastKnowParent points to the restored OU's distinguished name):

image

Both computer and user accounts that resided in TestOU are reanimated:

image

Download ADRestore.NET

הוסף תגובה
facebook linkedin twitter email

כתיבת תגובה

האימייל לא יוצג באתר. (*) שדות חובה מסומנים

21 תגובות

  1. fmustafa23 בינואר 2008 ב 8:57

    Seems good tool, but it gives error "Fails to Enumerate available domains" although I use Enterprise Admin and Domain Admin account!! Any idea on how to fix this??

    להגיב
  2. Paul Slager23 בינואר 2008 ב 17:23

    I get a failed to enumerate availbe domains. The error was logon failure unknown username or bad password. I am a schema admin and running the tool both off my domain connected client and directly off the DC and I get the same message. I also try to use a different schema admin account but nothing shows up when I hit enemuerate the Domain list isnt populated.

    להגיב
  3. Edwin Bakkes25 בינואר 2008 ב 11:41

    I get the same error when i start de application

    להגיב
  4. Guy Teverovsky25 בינואר 2008 ב 14:57

    Thanks guys, I'm looking into it.

    להגיב
  5. Guy Teverovsky27 בינואר 2008 ב 2:43

    Guys, looks like you downloaded the version from Daniel Petri's website and the one there was an old version with a bug. I have updated the version on http://www.petri.co.il server, so you might want to give it another shot: http://www.petri.co.il/ADRestore.NET.zip

    Sorry for inconvenience,
    Guy

    להגיב
  6. Aviad Avisar5 בפברואר 2008 ב 22:21

    נחמד.

    כמה שאלות :
    האם זה יודע לשחזר גם ססמא של המשתמש?
    האם יודע לשחזר רק ATTRIBUTE אחד של אבוייקט?

    להגיב
  7. Guy Teverovsky6 בפברואר 2008 ב 0:17

    Hi Aviad, nice to see your here too ;)

    As for your questions:

    Q: "Can the tool restore the password?"
    A: No. The tool does not restore the object to the state it was before the deletion. All it does is to reanimate the tombstone (which has a very limited number of attributes left). I suggest that you read Gil's article at Technet about tombstones for better understanding the difference between authoritative restore of an object and tombstone reanimation: http://www.microsoft.com/technet/technetmag/issues/2007/09/Tombstones/default.aspx

    Q: Can the tool restore a single attribute ?
    A: No. All it does is to bring the tombstone alive. If you change an attribute of on object and want to roll it back, there is no tombstone of the object, so the tool won't even see it. Again, this has to do with the way the tombstones work.

    The tool is not supposed to be a full recovery tool, but in certain situations all you need is the account and the SID (i.e.: deleted service account) – this is where the tool comes useful and saves you the time needed for authoritative restore.

    להגיב
  8. Yann26 במרץ 2008 ב 22:09

    Very awesome tool !
    I get used of using adrestore in command line, but for a GUI-guy as I am, it is just awesome.

    Thanks for sharing your tool.

    Cheers,

    Yann

    להגיב
  9. Ian30 במאי 2008 ב 14:34

    This tool is fantastic! It’s just made restoring some accidently deleted computer accounts a piece of cake. Thank you very much!

    להגיב
  10. FutureFuust10 ביוני 2008 ב 12:28

    hey, i just tried your tool for an assignment no school (restoring an OU), I installed the GUI version and got the following error:

    "Fails to Enumerate available domains"

    I read in the reply's above this is a know issue, just wanted to let u know it is still there

    ps. the command line version did the job just fine

    FutureFuust

    להגיב
  11. Jeremy Stump1 ביולי 2008 ב 0:42

    Using Ldp i can see dns node entries which get deleted from our env. I dont see in this tool where we can display those too. Is that coming?

    להגיב
  12. Guy Teverovsky2 ביולי 2008 ב 16:16

    Jeremy,
    The tool currently filters out the object classes other than user/computer/organizationalUnit/container. I did not see much value in making it support all available object classes.
    Btw, why would you want to restore DNS records? Unless those were static, it's easier to let the hosts re-register dynamically (if allowed).

    להגיב
  13. Dan22 ביולי 2008 ב 0:51

    Hi Guy,
    I've accidentally deleted a user with the administrative rigths on my laptop. Can I restore it by using your tool?
    I would grately appriciate any help you can provide.

    Thank you

    להגיב
  14. Guy Teverovsky22 ביולי 2008 ב 1:14

    Dan,

    The tool works only with Active Directory accounts. In order to restore local account you will probably have to revert to a Restore Point dated before the account deletion.

    להגיב
  15. Nils Kaczenski11 בספטמבר 2008 ב 2:24

    Guy,

    awesome. Just for your information and for everyone who needs it: I created a small script-based tool ("Werding") that helps in tombstone recovery.

    It does an attribute export of AD objects (when they still exist) and can write those attributes back to re-animated tombstones. That way you can recover additional data such as address data, but most importantly group membership of recovered objects. (The password will not be recovered, though. You have to set a new one, but that's better anyway.)

    See the international version at:
    [faq-o-matic.net » Werding v2 (English version): Online data recovery for Active Directory]
    http://www.faq-o-matic.net/2007/08/25/werding-v2-english-version-online-data-recovery-for-active-directory/

    Bye, Nils

    להגיב
  16. Ernst19 בספטמבר 2008 ב 4:19

    Hi Guy,

    Is it necessary to boot the server in ad restore mode?

    Thanks,

    Ernst

    להגיב
  17. Ernst19 בספטמבר 2008 ב 4:19

    Hi Guy,

    Is it necessary to boot the server in ad restore mode?

    Thanks,

    Ernst

    להגיב
  18. Guy Teverovsky19 בספטמבר 2008 ב 9:16

    Ernst, no need to boot into DSRM. This is tombstone reanimation and not authoritative restore

    להגיב
  19. Nugita10 בנובמבר 2008 ב 13:50

    Hy Guy

    Great tool, it helpded me restoring OU and workstations because a stupid AD especialist deleted all of them.
    One question …. Is there any way we can do a bulk restore (ie. workstations within the same OU)?

    Thanks,
    N.

    להגיב
  20. Ed9 בינואר 2009 ב 0:46

    Hey Guy,

    Great tool! Is there a way to select multiple objects? I need to restore over 100 computers…

    Thanks,
    Ed

    להגיב
  21. Carlos4 בפברואר 2009 ב 21:07

    I run the tool and I was able to see the computers recovered, just after I restored the OU. BUT, I can't log the PCs in the AD domain… am I missing something?

    להגיב